Diligence data deserves
diligence-grade security.
Zoe handles some of the most sensitive data a company has — org charts, decision flows, internal communication patterns. Here’s exactly how we protect it.
How we protect diligence data.
The six security pillars that govern how Zoe collects, processes, and stores every byte of customer data.
Encryption everywhere
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Keys are managed in dedicated KMS instances with automated rotation. No exceptions.
Least-privilege access
Role-based access controls with SSO and full audit logs. Diligence data is scoped per engagement and expires on a fixed schedule. No standing access.
Isolated tenancy
Each engagement runs in its own workspace with dedicated encryption keys. No cross-tenant data sharing, ever. Isolation is enforced at the storage layer, not in code.
Minimal data collection
Zoe collects only the metadata required to compute the diagnostic. We never read message bodies, code, documents, or financial line items. Source data can be purged immediately on request.
Compliance posture
SOC 2 Type II audit in progress. GDPR-aligned data handling. NDA and DPA available on request. HIPAA-aware architecture for healthcare engagements.
Responsible disclosure
Found a vulnerability? Email security@zoediagnostics.com. We respond within 24 hours and credit researchers in our public hall of fame.
Source data in.
Scores out.
Raw metadata enters an isolated processing workspace, gets transformed into anonymized signal, contributes to the nine-dimension scoring engine, then is discarded.
Only the resulting scores, findings, and aggregated patterns persist after the report ships. The raw data never survives the engagement. This isn’t a policy — it’s how the system is built.
Where we are with each framework.
Honest status, not marketing-speak. We’re building toward enterprise compliance and we’ll tell you exactly where each piece stands.
Request our security questionnaire.
Same-day delivery of our full security questionnaire, NDA, and DPA. We’ve been through enterprise procurement before.
Join 200+ firms on the waitlist